d4f57ed2613f12bb85fbdf832543f16ba7f3af377b9e17f8f0388ce594984877

Analysis

max time kernel
125s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28/06/2024, 01:51

Target

$PLUGINSDIR/BgImage.dll
Size

7KB
MD5

6f168e57757aceaa3356c496e80d04b0
SHA1

cd1fe64873d76e5a3e9eeca76d4425969247d057
SHA256

1b77f40da1181013a83dd924478849a41ba11ec139559c38af7b92e1715dbd4d
SHA512

7b724646f2f21db739638a9e78e02c2e1862aace531ea3bc10612f9e3d5996907533c0b92fd8008d79c7138af7e4fb7e1da9cf11ade2107ba7327f371319be91
SSDEEP

96:8eS0AKTIfv7QCUsthvNL85s4lk38Eb3CDfvEh8uLzqk6nLiEQjJ3KxkP:t8BfjbUA/85q3wEh8uLmNLpmP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 540 wrote to memory of 2988	540	rundll32.exe	88
PID 540 wrote to memory of 2988	540	rundll32.exe	88
PID 540 wrote to memory of 2988	540	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\BgImage.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:540
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\BgImage.dll,#1
  2⤵
  PID:2988

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4500,i,9746875443948590908,1444894342962555245,262144 --variations-seed-version --mojo-platform-channel-handle=4180 /prefetch:8
1⤵
PID:2368